C:\Users\brusk\Desktop\aa\BALDEAGLE\BaldEagle\x64\Release\BaldEagle.pdb
Static task
static1
Behavioral task
behavioral1
Sample
chaka stealert/BaldEagle.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
chaka stealert/BaldEagle.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
chaka stealert/Builder.exe
Resource
win7-20240220-en
Behavioral task
behavioral4
Sample
chaka stealert/Builder.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
chaka stealert/Core.dll
Resource
win7-20240419-en
Behavioral task
behavioral6
Sample
chaka stealert/Core.dll
Resource
win10v2004-20240226-en
General
-
Target
chaka stealert.rar
-
Size
3.2MB
-
MD5
eb06edc161cd90e127feb469f0a9c3f0
-
SHA1
dcae5eb6e4d646995aae1de96406eb65e9bcf63b
-
SHA256
e25e138144d401b098a4c2291995f8e15f7cd59edab511629ccd93a210c26c35
-
SHA512
0f2a7fccc3c58ca04e2be4c68a8ca3a7a5d0304469742edad9bdc41c22db673e19b01633cc07041b5fb8874fa7a912da8f0a9368c364d53b7ce2dedba9910ba8
-
SSDEEP
98304:tTwXildVEeM/wl0G2ok8sM3uzDSfL7duOylda/:thl2/wl0FpM3uzD8dl
Malware Config
Signatures
-
Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/chaka stealert/BaldEagle.exe unpack001/chaka stealert/Builder.exe unpack001/chaka stealert/Core.dll
Files
-
chaka stealert.rar.rar
-
chaka stealert/BaldEagle.exe.exe windows:6 windows x64 arch:x64
94c2483f3c4e5ed6c8deb3968fe6eada
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
wldap32
ord32
ord33
ord35
ord27
ord30
ord200
ord301
ord22
ord26
ord79
ord41
ord50
ord45
ord60
ord211
ord46
ord217
ord143
crypt32
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CryptUnprotectData
CryptStringToBinaryA
CertFreeCertificateChain
PFXImportCertStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
ws2_32
setsockopt
getservbyport
inet_ntop
getsockopt
send
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
shutdown
getservbyname
gethostbyname
gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
inet_addr
inet_ntoa
gethostbyaddr
WSAIoctl
normaliz
IdnToAscii
kernel32
RtlCaptureContext
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
CreateEventW
OpenProcess
K32GetModuleFileNameExA
CloseHandle
K32EnumProcesses
K32GetModuleFileNameExW
GetModuleHandleA
RaiseException
FindFirstFileA
FindNextFileA
FindClose
CopyFileA
ReadFile
GetLastError
CreateFileA
GetFileSize
GetTempPathA
GetFileAttributesA
DeleteFileA
RemoveDirectoryA
CreateDirectoryA
GlobalAlloc
GlobalLock
GlobalUnlock
Sleep
WriteFile
CreatePipe
WaitForSingleObject
CreateProcessA
GetDriveTypeA
lstrlenA
GetLogicalDriveStringsA
GetVolumePathNameA
SetFileAttributesA
ReleaseMutex
GetLogicalDrives
GetFileAttributesExA
GetFileSizeEx
TerminateProcess
K32GetProcessImageFileNameA
MultiByteToWideChar
IsDebuggerPresent
ExitProcess
LocalFree
GetModuleFileNameA
GetFileAttributesW
SetFileAttributesW
CreateDirectoryW
Process32First
CreateToolhelp32Snapshot
Process32Next
SetFileTime
GetModuleFileNameW
GetNativeSystemInfo
SystemTimeToFileTime
GetUserDefaultLocaleName
GetSystemPowerStatus
GetTempPathW
LocalAlloc
DeleteFileW
GlobalMemoryStatusEx
WideCharToMultiByte
FormatMessageA
GetComputerNameA
K32GetModuleBaseNameA
lstrcpyW
QueryFullProcessImageNameW
K32EnumProcessModules
GetStdHandle
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SetLastError
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetProcAddress
LoadLibraryA
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
PeekNamedPipe
WaitForMultipleObjects
GetCurrentProcessId
SleepEx
VerSetConditionMask
VerifyVersionInfoW
FlushFileBuffers
MapViewOfFile
CreateFileMappingW
GetSystemTime
GetSystemTimeAsFileTime
GetProcessHeap
LockFileEx
UnlockFile
HeapDestroy
HeapCompact
HeapAlloc
LoadLibraryW
GetSystemInfo
HeapReAlloc
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetDiskFreeSpaceA
HeapSize
HeapValidate
UnmapViewOfFile
CreateFileW
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
GetFullPathNameW
HeapFree
HeapCreate
AreFileApisANSI
InitializeCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
GetStartupInfoW
GetModuleHandleW
RtlVirtualUnwind
GetEnvironmentVariableW
GetModuleHandleExW
VirtualFree
GetACP
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeSListHead
GetLocaleInfoEx
CreateMutexA
TlsFree
user32
CallNextHookEx
GetWindowTextA
GetWindow
GetWindowThreadProcessId
MessageBoxW
GetUserObjectInformationW
GetProcessWindowStation
SystemParametersInfoA
GetMessageA
DispatchMessageA
TranslateMessage
GetKeyState
GetKeyNameTextA
SetWindowsHookExA
CharUpperA
CharLowerA
GetDC
SetProcessDPIAware
ReleaseDC
GetForegroundWindow
OpenClipboard
CloseClipboard
EmptyClipboard
GetClipboardData
SetClipboardData
GetTopWindow
gdi32
CreateCompatibleBitmap
SelectObject
DeleteDC
DeleteObject
GetDeviceCaps
BitBlt
CreateCompatibleDC
advapi32
RegQueryInfoKeyA
RegQueryValueExA
RegCloseKey
RegEnumKeyExA
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGenRandom
CryptAcquireContextW
ReportEventW
RegisterEventSourceW
DeregisterEventSource
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA
RegOpenKeyExA
GetUserNameA
RegCreateKeyExA
RegSetValueExA
RegOpenKeyExW
CryptCreateHash
CryptHashData
CryptDestroyHash
RegQueryValueExW
shell32
SHGetFolderPathA
SHGetSpecialFolderPathA
SHCreateDirectoryExA
SHGetFolderPathW
SHGetKnownFolderPath
ole32
CreateStreamOnHGlobal
OleUninitialize
CoInitializeEx
CoSetProxyBlanket
CoCreateInstance
CoUninitialize
OleInitialize
CoInitializeSecurity
oleaut32
SysAllocString
VariantClear
OleCreatePictureIndirect
VariantInit
SysFreeString
msvcp140
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
_To_byte
_Link
_File_size
_Read_dir
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
_Lstat
_Open_dir
_Close_dir
_Symlink
_Remove_dir
_Unlink
_Copy_file
_Last_write_time
?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z
_Equivalent
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??Bios_base@std@@QEBA_NXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_id
_Thrd_join
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?_Throw_C_error@std@@YAXH@Z
_Thrd_detach
?_Random_device@std@@YAIXZ
?id@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A
?_Getcat@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?put@?$time_put@DV?$ostreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$ostreambuf_iterator@DU?$char_traits@D@std@@@2@V32@AEAVios_base@2@DPEBUtm@@PEBD3@Z
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
_Strxfrm
?_Incref@facet@locale@std@@UEAAXXZ
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?in@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEA_W3AEAPEA_W@Z
??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@J@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Syserror_map@std@@YAPEBDH@Z
??0_Locinfo@std@@QEAA@PEBD@Z
_To_wide
?_Xbad_function_call@std@@YAXXZ
?_Winerror_map@std@@YAHH@Z
??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ
??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Stat
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z
?good@ios_base@std@@QEBA_NXZ
??7ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
_Query_perf_frequency
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
_Make_dir
winhttp
WinHttpQueryDataAvailable
WinHttpReceiveResponse
WinHttpOpen
WinHttpQueryHeaders
WinHttpReadData
WinHttpOpenRequest
WinHttpCloseHandle
WinHttpSendRequest
WinHttpConnect
wininet
InternetCrackUrlA
shlwapi
PathIsDirectoryA
PathFindFileNameW
PathFindFileNameA
PathFileExistsA
PathFindExtensionA
PathRemoveFileSpecA
PathStripPathA
PathCombineA
PathFileExistsW
PathRemoveFileSpecW
bcrypt
BCryptOpenAlgorithmProvider
BCryptCloseAlgorithmProvider
BCryptSetProperty
BCryptGenerateSymmetricKey
BCryptGenRandom
BCryptDecrypt
dwmapi
ord102
msi
ord245
ord67
iphlpapi
GetIpAddrTable
GetAdaptersInfo
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_destroy
__std_exception_copy
__std_terminate
strrchr
__C_specific_handler
strchr
__std_type_info_compare
strstr
memcpy
memset
memchr
memmove
memcmp
_CxxThrowException
wcsstr
__current_exception
__current_exception_context
api-ms-win-crt-stdio-l1-1-0
_lseeki64
_fseeki64
fread
fsetpos
__stdio_common_vswprintf
_open
__stdio_common_vsprintf_s
ungetc
__stdio_common_vfprintf
_write
_fileno
_setmode
_wfopen
_read
__stdio_common_vsscanf
_get_stream_buffer_pointers
__p__commode
__stdio_common_vsprintf
setvbuf
fputs
fgetpos
__acrt_iob_func
fwrite
_ftelli64
ftell
feof
fseek
fgets
_pclose
_wpopen
ferror
fgetc
fclose
fflush
fputc
_set_fmode
fopen
_close
api-ms-win-crt-heap-l1-1-0
realloc
free
_callnewh
malloc
calloc
_msize
_set_new_mode
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_unlink
_lock_file
_splitpath_s
_access
_fstat64
_chdir
_stat64i32
_stat64
api-ms-win-crt-string-l1-1-0
tolower
strncpy_s
strcpy_s
isdigit
strcat_s
_strdup
strncpy
toupper
strspn
strcspn
strncmp
strpbrk
isspace
strcmp
api-ms-win-crt-runtime-l1-1-0
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
_errno
_set_app_type
terminate
_initterm_e
exit
_c_exit
_seh_filter_exe
_crt_atexit
__sys_errlist
__sys_nerr
_beginthreadex
_register_onexit_function
_initialize_onexit_table
_initterm
_cexit
signal
_invalid_parameter_noinfo_noreturn
strerror_s
raise
_exit
_endthreadex
_register_thread_local_exe_atexit_callback
api-ms-win-crt-convert-l1-1-0
strtod
strtoll
strtoull
wcstombs
strtoul
atoi
strtol
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_localtime64_s
_gmtime64
_time64
_localtime64
strftime
api-ms-win-crt-math-l1-1-0
ceilf
_dclass
_dsign
__setusermatherr
_fdopen
api-ms-win-crt-locale-l1-1-0
localeconv
_configthreadlocale
api-ms-win-crt-utility-l1-1-0
srand
rand
qsort
api-ms-win-crt-multibyte-l1-1-0
_mbsicmp
Sections
.text Size: 4.2MB - Virtual size: 4.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 991KB - Virtual size: 990KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 155KB - Virtual size: 155KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 59KB - Virtual size: 58KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 38KB - Virtual size: 38KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
chaka stealert/Builder.exe.exe windows:4 windows x64 arch:x64
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
C:\Users\brusk\Desktop\BALDEAGLE\Builder\obj\x64\Release\Builder.pdb
Sections
.text Size: 205KB - Virtual size: 205KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
-
chaka stealert/Builder.exe.config
-
chaka stealert/Builder.pdb
-
chaka stealert/Core.dll.dll windows:6 windows x64 arch:x64
191f497f1d902260f406a595328f4573
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
C:\Users\brusk\Desktop\BALDEAGLE\BaldEagle\x64\Release\Core.pdb
Imports
crypt32
CertOpenStore
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertGetCertificateContextProperty
CertDuplicateCertificateContext
ws2_32
socket
setsockopt
connect
closesocket
ioctlsocket
recv
WSASetLastError
getservbyname
getservbyport
gethostbyaddr
inet_ntoa
inet_addr
shutdown
send
getsockopt
ntohs
select
gethostbyname
WSAStartup
WSACleanup
WSAGetLastError
htonl
htons
kernel32
RtlLookupFunctionEntry
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
RtlCaptureContext
InitializeSListHead
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
RtlVirtualUnwind
GetEnvironmentVariableW
GetModuleHandleExW
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualFree
WideCharToMultiByte
GetACP
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA
CloseHandle
LoadLibraryW
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
user32
MessageBoxW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
DeregisterEventSource
CryptDestroyHash
CryptSignHashW
CryptEnumProvidersW
CryptDecrypt
CryptExportKey
CryptGetUserKey
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptGenRandom
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptCreateHash
msvcp140
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??Bid@locale@std@@QEAA_KXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??Bios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAI@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?_Xlength_error@std@@YAXPEBD@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uncaught_exception@std@@YA_NXZ
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
memchr
strstr
strrchr
memmove
memcmp
wcsstr
memset
memcpy
__std_exception_destroy
__std_exception_copy
_CxxThrowException
__std_type_info_destroy_list
strchr
__std_terminate
api-ms-win-crt-heap-l1-1-0
realloc
_callnewh
free
malloc
calloc
api-ms-win-crt-runtime-l1-1-0
_initialize_narrow_environment
_cexit
_initialize_onexit_table
_seh_filter_dll
_exit
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_execute_onexit_table
signal
_configure_narrow_argv
_initterm_e
_crt_atexit
_initterm
raise
_errno
strerror_s
api-ms-win-crt-stdio-l1-1-0
fgets
_fileno
__stdio_common_vsprintf_s
_setmode
ferror
_wfopen
fseek
fopen
__stdio_common_vfprintf
ftell
__stdio_common_vsscanf
fputs
__acrt_iob_func
ungetc
fputc
fgetc
__stdio_common_vsprintf
__stdio_common_vswprintf
_get_stream_buffer_pointers
fgetpos
_fseeki64
fsetpos
setvbuf
fflush
fclose
fwrite
feof
fread
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
_unlock_file
_lock_file
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-string-l1-1-0
strspn
strcspn
strcmp
strncpy
isdigit
tolower
strncpy_s
strcat_s
strcpy_s
isspace
strncmp
api-ms-win-crt-time-l1-1-0
_time64
_gmtime64_s
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-convert-l1-1-0
atoi
strtol
strtoul
Exports
Exports
Run
Sections
.text Size: 2.6MB - Virtual size: 2.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 713KB - Virtual size: 713KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 17KB - Virtual size: 27KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 91KB - Virtual size: 91KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 248B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 33KB - Virtual size: 33KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ